Recovery windows for misappropriated digital assets are measured in hours, not weeks. For an early-stage founder – operating with lean treasury, no institutional incident-response team and a product that lives on-chain – the window between a theft and an irreversible loss is brutally short. On-chain asset tracing (the forensic identification and real-time monitoring of stolen digital assets across blockchain networks) is the first instrument deployed. Without it, every downstream step – freezing orders, exchange disclosure, stablecoin issuer cooperation – operates on guesswork rather than evidence.
This page explains how professional on-chain tracing works in a legal context, what it takes to translate a transaction hash into courtroom-ready evidence, and how OBOLUS coordinates rapid cross-border relief for founders who are watching funds move in real time.
Why Early-stage Founders Face Unique Recovery Risk
Founders at the seed and Series A stage carry disproportionate exposure to digital-asset theft precisely because their controls are light. Treasury management may rest with one or two signatories. Smart contract deployment keys may live on a single hardware device. And the legal infrastructure – insurance, custodial agreements with freeze-capable counterparties, standing relationships with forensics providers – almost never exists at the point it is needed.
The result is a predictable pattern. A treasury wallet is compromised, a phishing attack drains a multisig, or a rogue contractor sweeps a hot wallet. The founder identifies the loss within hours but spends the next critical window trying to understand what happened rather than acting. By the time counsel is engaged, funds may have passed through two or three mixer hops or been bridged to a network where court jurisdiction is less clear. In our cross-border practice, we see this sequence regularly – and the cases that reach a positive outcome are almost always those where tracing and legal action began simultaneously.
The cross-border dimension compounds the difficulty. A London-based founder may hold treasury on an exchange domiciled in the Cayman Islands, receive funds from a Singaporean investor, and find that the theft route passes through exchanges registered under the BVI Financial Services Commission and VARA in Dubai. Each hop introduces a different disclosure standard and a different timeline for obtaining emergency relief.
What Does On-chain Tracing Actually Involve?
On-chain tracing is a structured forensic process, not a single database query. It begins with the transaction hash of the first unauthorized transfer and follows the funds – hop by hop – through every wallet, bridge, exchange deposit address and smart contract interaction until the funds either become dormant, are converted to fiat, or reach an address that can be attributed to a known entity.
The core steps are consistent across most matters. First, the incident is scoped: the loss transaction is identified, the affected addresses are listed, and the earliest possible on-chain timestamp is established. Second, a professional forensic report is prepared using specialist tools – platforms capable of cluster analysis, entity attribution and cross-chain bridging detection. Third, the report is reviewed for legal sufficiency: a court filing requires not just a transaction graph but a clear narrative of control, a statement on methodology, and – where stablecoin issuers are involved – documentation meeting the standard that Tether (USDT) and Circle (USDC) require before exercising their contract-level blacklist authority.
The legal product of that report determines which forums and which instruments are available. A well-constructed forensic report, served with an emergency without-notice application in England and Wales, can support a worldwide freezing order (an injunction freezing a defendant's assets globally) within a single court day. The same report, transmitted to a major exchange with a supporting law-enforcement reference, may trigger an internal account hold within hours.
Founders often underestimate how much the quality of the forensic report dictates the speed and success of every downstream step. A report that attributes funds to an exchange deposit address without establishing the account-holder link is insufficient for a Norwich Pharmacal application. We work with specialist forensics providers to ensure the legal and evidentiary standards are met before the application is filed.
A key point for founders: the transaction graph alone is not evidence. It becomes evidence when a qualified analyst attests to the methodology, the attribution logic is explained to a non-technical court, and the chain of custody of the blockchain data is documented. That translation work is where legal counsel and forensic expertise must operate together.
The Legal Instruments Available to Founders
On-chain tracing produces the evidentiary base; the legal instruments convert that base into enforceable relief. For founders, the most commonly relevant instruments are freezing orders, exchange disclosure orders and stablecoin issuer cooperation.
A worldwide freezing order is available in England and Wales, Hong Kong and Singapore – three forums where courts have confirmed that digital assets constitute property susceptible to injunctive relief. In England and Wales, the decision in AA v Persons Unknown [2019] established the property status of Bitcoin and opened the door to freezing relief against unknown defendants – a critical feature in theft cases where the thief has not yet been identified. Courts in the DIFC have also demonstrated willingness to grant freezing orders, including in support of proceedings commenced in foreign jurisdictions.
A Norwich Pharmacal order (an order compelling a third-party holder of information – typically an exchange – to disclose the identity of an account holder) can be obtained in England and Wales, Hong Kong and several other common-law forums. The threshold is a prima facie case that a wrong has been committed and that the respondent holds the relevant information. A clear forensic trail to a named exchange deposit address, accompanied by a professional report, typically meets that threshold.
Stablecoin issuer cooperation is a parallel channel, not a substitute for court process. Tether and Circle hold contract-level authority to freeze tokens in specific addresses; in practice, they act on a law-enforcement request or a court order, and the relevant documentation standards are demanding. We prepare the supporting package – forensic report, law-enforcement reference, and legal correspondence – in parallel with court applications so that the issuer route is live on the same timeline.
CTA #1 – For founders meeting this issue for the first time: The process described above represents the standard path for straightforward theft of a single-chain asset. Your situation – the wallet type, the exchange relationships, the asset class, the jurisdiction of your entity – changes the analysis materially. Map your options with our disputes team before the trail cools.
Common Mistakes Founders Make in the First 24 Hours
The most damaging mistake is delay. Founders who spend the first day attempting to resolve the matter informally – contacting the exchange directly without legal support, posting to crypto forums, or waiting for a security contact to respond – lose the window in which a without-notice freezing application has the strongest effect. By the time a court order is obtained, the funds may have been dispersed across multiple wallets or converted to privacy-preserving assets.
The second mistake is contaminating the forensic record. Moving remaining funds, interacting with the attacker's address, or taking manual on-chain actions without legal advice can create complications in subsequent proceedings. Courts and forensic analysts rely on a clean, uninterrupted transaction graph; founder-initiated transactions in the aftermath of theft can obscure the attribution logic.
The third mistake is treating on-chain tracing as a DIY exercise. Free blockchain explorers show transaction data. They do not produce court-ready attribution analysis, they do not interface with exchange compliance teams in a legally structured way, and they do not produce the professional attestation that issuer freeze requests require. We have seen matters where founders spent several days tracing funds manually and then engaged counsel – by which point the trail had been obscured and the evidence chain was weakened.
Finally, founders frequently misjudge which forum has jurisdiction. An entity incorporated in the BVI whose treasury was held on a Cayman-regulated exchange may find that the most effective freezing remedy sits in England and Wales – not because the parties are English, but because English courts have the broadest worldwide reach, the most developed crypto-asset case law, and the fastest without-notice procedure. The CFAAR network – launched in London in September 2021 – also provides a practitioner coordination channel that accelerates multi-jurisdictional recovery steps.
How Does Cross-border Tracing Work Across Multiple Forums?
Most theft routes cross at least two jurisdictions; many cross four or more. A single cohesive strategy must identify the optimal primary forum, the secondary enforcement points, and the issuer or exchange contacts required in each.
In our practice, the primary forum decision turns on four factors: where the founder's entity is incorporated or resident, where the exchange holding the stolen funds is domiciled or regulated, where the most legally significant portion of the asset trail currently sits, and which forum offers the fastest without-notice procedure with the broadest extraterritorial reach. England and Wales satisfies the last criterion most consistently. But where the exchange is regulated under MAS in Singapore, where funds are sitting in an ADGM-domiciled account, or where the thief is believed to be operating from Dubai, supplementary steps in those forums are often necessary in parallel.
A cross-border matter typically involves: a primary freezing and disclosure application in the lead common-law forum, a parallel notification to the relevant exchange compliance desk with a supporting forensic package, stablecoin issuer outreach where USDT or USDC is involved, and – once a defendant is identified – enforcement steps in the jurisdiction of their assets. We coordinate allied counsel in the relevant jurisdictions for the local steps, maintaining a single instructing point for the founder.
A recent matter illustrates the pattern. A payments startup identified an unauthorized sweep of its treasury wallet on a Friday evening. Funds had moved through three wallet hops and landed at a deposit address on a major exchange regulated in a Gulf jurisdiction. By Monday morning, we had filed a without-notice freezing application in England and Wales, served a forensic package on the exchange's legal team, and prepared a stablecoin issuer freeze request. The exchange placed a hold on the account before any withdrawal was processed, and the founder recovered the majority of the misappropriated balance within a matter of weeks. No specific figures are attributed to this matter; the outcome is described qualitatively to preserve client confidentiality.
Decision Matrix: Which Recovery Path Fits Your Situation?
The right combination of instruments depends on the specific facts of the theft, the asset class involved, and the forum relationships available. The following profiles illustrate the most common scenarios.
Profile A – Exchange-held funds, identified deposit address: Where forensic tracing has followed the stolen assets to a named exchange deposit address, the priority action is a simultaneous without-notice application to a common-law court and a legally structured exchange notification. England and Wales, Singapore and Hong Kong all support this route. Timeline to a hold or freezing order: typically a matter of days in the most expeditious forums. Key risk: the exchange may have already processed a withdrawal before the legal request arrives.
Profile B – Stablecoin assets, partial mixer obfuscation: Where stolen funds are denominated in USDT or USDC and have passed through a mixer but can still be traced to a post-mix address, the issuer freeze channel becomes the primary instrument. A court order or law-enforcement reference is generally required; a forensic report establishing post-mix attribution is essential. Timeline: the quality of the forensic attribution largely determines the speed. Key risk: a fragmented post-mix transaction graph may not meet the issuer's attribution standard.
Profile C – Cross-chain bridge, unknown recipient: Where funds have been bridged to a secondary chain and the recipient wallet is unattributed, the immediate objective is monitoring and identification – not yet enforcement. A professional forensics provider places the address under alert. Legal applications are prepared and held, ready to file the moment an exchange deposit is detected. This is the scenario where time already lost is most costly, and where the gap between tracing capability and available legal relief is widest. Key risk: the recipient may never deposit to a regulated exchange.
Profile D – Insider or contractor theft, identifiable defendant: Where the defendant is known – a rogue employee, a former co-founder, a contractor with key access – the matter shifts from unknown-defendant freezing to targeted civil fraud litigation. A Mareva injunction (a form of freezing relief in common-law jurisdictions) can be obtained rapidly on a without-notice basis. Cross-border enforcement depends on where the defendant holds assets. Timeline: from first instruction to an interim injunction, typically a matter of days in an expeditious forum. Key risk: the defendant may have already dissipated assets.
CTA #2 – For founders who already tried and hit a wall: A prior informal approach to the exchange, a rejected manual freeze request, or an initial legal application that did not succeed does not foreclose recovery. A structured second review can identify the step that was missed and the forum that was not used. Write to our disputes team with your transaction hashes and the timeline of your matter – we will assess the remaining options.
Addressing the Assumption That Nothing Can Be Done
A common assumption among founders who have experienced digital-asset theft is that the irreversibility of blockchain transactions means recovery is impossible. That assumption is incorrect, and it costs founders who accept it without legal advice the opportunity to act while the window remains open.
The blockchain is permanent. But possession of funds is not. A court order freezing an exchange account prevents the thief from accessing funds that sit at that exchange. A stablecoin issuer freeze makes the stolen tokens non-transferable regardless of who holds the private key. A Norwich Pharmacal order compels the exchange to identify the account holder, turning an anonymous blockchain address into a named defendant against whom civil fraud proceedings can be brought.
The question is not whether blockchain transactions are reversible. The question is whether the funds have reached a point – an exchange account, a stablecoin address, an identified wallet – at which legal instruments can intercept them. In a meaningful proportion of the matters we see, the answer at the time of first instruction is yes. The proportion declines sharply with each passing day, which is why the founding assumption of this page – that recovery windows are measured in hours – is not rhetorical. It is the practical reality of on-chain theft response.
Self-assessment: Are You Ready to Act?
Before engaging counsel, founders can take several immediate steps that will accelerate the legal process and preserve the evidentiary record.
- Identify and record the transaction hash of the first unauthorized transfer. Do not interact further with the affected wallets.
- Preserve screenshots of any relevant communications – internal messages, contractor instructions, exchange confirmations – without deletion or alteration.
- Check whether the stolen asset is a stablecoin (USDT, USDC or similar); if so, identify the issuer and note the contract address.
- Identify the exchange or exchanges to which the stolen funds appear to have been sent, using a blockchain explorer. Note the deposit address but do not contact the exchange directly until legal strategy is agreed.
- Note the approximate time of the theft and identify any witnesses or system logs that confirm the unauthorized access.
- Confirm your entity's jurisdiction of incorporation and the jurisdiction of any relevant exchange. This determines which court forum is most accessible.
This checklist is preparation, not a substitute for immediate legal engagement. The more complete the information at first instruction, the faster the application can be assembled and filed.
Related at OBOLUS
- Disputes and asset recovery for digital-asset businesses – the full scope of our recovery practice across civil fraud, injunctions and enforcement
- Smart contract dispute resolution in Liechtenstein – how Liechtenstein's legal regime treats on-chain obligations and smart contract disputes
- On-chain asset tracing for regulated entities – the tracing and recovery process for exchanges, custodians and licensed VASPs
FAQ
Can stolen crypto actually be recovered?
Recovery is possible but time-sensitive and fact-specific. Courts in England and Wales, Hong Kong and Singapore have confirmed that digital assets are property subject to freezing orders and disclosure obligations. Where stolen funds can be traced to an exchange deposit address or a stablecoin contract, legal instruments – including without-notice freezing orders, Norwich Pharmacal disclosure orders and issuer freeze requests – can intercept the assets before they are withdrawn or dispersed. Outcome depends on the speed of instruction, the quality of forensic tracing and the forum in which relief is sought.
How fast must I act after a digital-asset theft?
Immediate action – within hours of identifying the loss – gives the strongest prospect of recovery. Without-notice freezing applications can be filed and heard on the same day in the most expeditious common-law forums. Stablecoin issuer freeze requests require a forensic report and, typically, a law-enforcement reference; preparing that package takes time. Every hour of delay increases the probability that funds have moved beyond the reach of available legal instruments. Contact legal counsel as soon as the loss is identified, in parallel with any internal incident response.
Can a court freeze assets held on an exchange?
Yes. Courts in England and Wales, Singapore, Hong Kong and the DIFC have jurisdiction to grant injunctions that bind exchanges as third parties, compelling them to freeze accounts to which stolen assets have been traced. A worldwide freezing order can cover assets on exchanges in multiple jurisdictions simultaneously. Exchange compliance teams are legally obligated to comply with a valid court order served on them. The forensic tracing package must establish a clear link between the stolen funds and the specific exchange account for the order to be effective.
OBOLUS is an independent digital-asset law boutique acting only for businesses. We advise exchanges, custodians, token issuers and founders on disputes and on-chain asset recovery across 25+ forums, and on the licensing, structuring and compliance matters that sit around them. Digital assets are the whole of our practice. Our disputes team coordinates freezing relief, exchange disclosure and stablecoin issuer cooperation across leading common-law forums, moving for relief while the trail is live. To discuss a matter, contact info@oboluslaw.com or message us at t.me/oboluslaw.
By Glen Sorensen, Disputes & Recovery Analyst – specialising in on-chain asset tracing, cross-border freezing relief and digital-asset fraud recovery for early-stage and institutional clients.
This publication is general information about the law and does not constitute legal advice. It is not a substitute for advice tailored to your circumstances. OBOLUS accepts no liability for action taken or not taken on the basis of this material. For advice on your situation, contact info@oboluslaw.com.